Application programs, network services, and others have made an attempt at specifying a delay point and an abnormal point under a state of the actual operation.
In general, for specifying a delay point or an abnormal point of a system, continuous monitoring for the state of the system is needed, sampling logs before and after of each point. For a processing sequence has processes of start-A-B-C-D-end, logs with time stamps are obtained at points of immediately before A, between A and B, between B and C, between C and D, and immediately after D. This makes it possible to specify which process among processes A-D delays. Assuming that process B delays, the process B can be specified to be the delay point by referring to the log immediately before B (i.e., the log between A and B) and the long immediately after process B (i.e., the log between B and C).
[Patent Literature 1] Japanese Laid-open Patent Publication No. HEI 8-147344
[Patent Literature 2] Japanese Laid-open Patent Publication No. 2000-83057
Here, specifying a delay point or an abnormal point of a system in, for example, an application program or a network service, needs sampling of a large number of log at many monitoring points. For the above, narrowing and specifying a delay point or an abnormal point accompanies large overhead and heavy network load.
In order to specify a problem point (delay point or abnormal point) without undesired overhead and network load, an attempt has been made at obtaining path information (operation flow) of each function (process) through obtaining and analyzing detailed logs in advance. During the actual operation, this attempt obtains the operation information (request log) of the actual operation. In the event of occurrence of a problem, the problem point is analyzed and specified by using the path information obtained beforehand and the operation information obtained during the actual operation. Hereinafter, a problem point may also be referred to as a delay causing point or a problem component.
Here, the path information includes, for example, information (component group) to specify the components used by each function. The path information of each Web function is classified according to a Uniform Resource Identifier (URI) containing a Uniform Resource Locator (URL).
For example, providing that network components c1-c5 are given as denoted in FIG. 2, message data flowing through each of the components c1-c5 is analyzed. The analysis classifies components used by each function Fi (where i is a natural number) as following formulae through the use of the URL+CGI (Common Gateway Interface) parameter for each function Fi.
Path of function F1
(http://foo.com/appli1.cgi?flag=exec)=c1-c2-c4-c5
Path of function F2
(http://foo.com/appli1.cgi?flag=calc)=c1-c3-c5
Path of function F3
(http://foo.com/appli1.cgi?data=true)=c1-c2
Path of function F4
(http://foo.com/appli2.cgi?feature=3)=c3-c4
However, even if the function (i.e., URL+CGI parameter) is the same, pieces of path information corresponding to the same function may be different in components contained therein, depending on various circumferences of the operation time zone, the day of the week, a request pattern, and/or the state of the database. In other words, in some circumference, the same function may have different path information and may consequently flow multiple different paths. In this case, the different pieces of path information of the same function are integrated into a single piece of path information of the same function and the integrated path information is defined so as to contain all the components that the same function flows through. Accordingly, the path information may contain an undetermined (indecisive) part. If the path information contains an undetermined part, an analysis is conducted during the actual operation, not grasping which request uses which components, so that an exact delay causing point is not specified (estimated).